= Attribute Lists

An attribute list contains a set of attributes.  The allowed lists
are:

`request`:: Attributes in the incoming request packet.

`reply`:: Attributes in the outgoing reply packet.

`control`:: Attributes in the internal "control" list that is
associated with the request.
+
The `control` attributes are used to manage how the request is
processed.  These attributes are never sent in any packet.

`session-state`:: Attributes which are maintained across multi-packet
exchanges.

There must be a dot `.` after the list name and before the attribute name.
This syntax helps the server to distinguish between list names and attribute
names.

NOTE: In version 3, there were additional lists such as `proxy`,
`proxy-reply`, and `coa`.  These lists have been removed in version 4.
See the xref:unlang/subrequest.adoc[subrequest] keyword for how to create
child requests.

With the exception of `session-state`, all of the above lists are
ephemeral.  That is, they exist for one packet exchange, and only one
packet exchange.  When a reply is sent for a request, the above lists
and all attributes are deleted.  There is no way to reference an
attribute from a previous packet.  We recommend using a database to
track complex state.

In some cases, requests are associated a multi-packet exchange.  For
those situations, the `session-state` list is automatically saved when
a reply is sent, and it is automatically restored when the next packet
in sequence comes in.  Once the packet exchange has been finished, the
`session-state` list is deleted.

In some cases, there is a parent-child relationship between requests.
In those situations, it is possible for the policy rules in the child
to refer to attributes in the parent.  This reference can be made by
prefixing the _<list>_ name with the `parent` qualifier.  The key word
`outer` is also a synonym for `parent`.  If there are multiple
parent-child relationships, the `parent` qualifier can be repeated.

There is, however, no way for the parent to refer to the child.  When
the child is running, the parent is suspended.  Once the child
finishes, it is deleted, and is no longer accessible to the parent.

.Examples
`&parent.request.User-Name` +
`&parent.reply.Reply-Message` +
`&parent.parent.session-state.Filter-Id`
